CVE-2026-53848CWE-184

OpenClaw < 2026.5.26 - Exec Allowlist Bypass via Transparent Command Wrappers

Low · published June 16, 2026

CVSS v4.0
2.3
EPSS
0%
Percentile
22.8
In the wild
Unconfirmed
What it is

OpenClaw before 2026.5.26 contains an exec allowlist bypass vulnerability allowing authenticated operators to execute wrapper-level side effects outside allowlisted command intent. Attackers can craft command requests that bypass allowlist validation by leveraging transparent command wrappers to perform unintended operations.

The record
Technical detail
CVSS v4.0
2.3 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00312 · 22.8th percentile
Weakness
CWE-184 · Incomplete List of Disallowed Inputs
Published
2026-06-16T18:04Z
EPSS history
Timeline
  • 16 JUN 18:04Z
    OpenClaw < 2026.5.26 - Exec Allowlist Bypass via Transparent Command Wrappers
    cvelistv5